Privacy Policy

Last updated: 27 September 2026

This Privacy Policy explains how Oro y Luna (“Oro y Luna”, “we”, “us”) collects, uses, shares and protects your personal data when you visit https://oroyluna.com/ or buy from us. We process personal data in accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under them. By using our website you agree to this policy.

1. Information we collect

Information you give us

• Account details: name, email address, mobile number and password (stored only in encrypted, hashed form).
• Order details: shipping address, items, sizes and colours ordered, order notes, and exchange or return requests.
• Content you submit: product reviews, messages sent through our contact form, and newsletter sign-ups.

Information collected automatically

• Technical data: IP address, browser and device type, and pages requested, recorded in our server logs for security and troubleshooting.
• Cookies and local storage: see section 6.

Payment information

Online payments are processed by Razorpay. Your card, UPI, net-banking or wallet details are entered on Razorpay's secure page and are never received or stored by us. We only receive a payment reference, the amount and its status.

2. How we use your information

• To process, ship and deliver your orders, and to handle cancellations, size exchanges, returns and refunds.
• To create and manage your account, saved addresses and wishlist.
• To send you transactional messages: order confirmations, shipping and delivery updates, and password-reset emails.
• To respond to your questions and complaints.
• To issue invoices and keep records required by tax and accounting laws (including GST).
• To prevent fraud, misuse and security incidents, and to enforce our Terms & Conditions.
• To send newsletters and offers — only if you subscribe. You can unsubscribe at any time.

3. Legal basis

We process your personal data with your consent, which you give when you create an account, place an order, subscribe or contact us, and for legitimate uses permitted by law — for example, to complete a purchase you requested or to comply with legal obligations. You may withdraw consent at any time (see section 8); this will not affect processing already carried out, but we may no longer be able to provide some services, such as fulfilling an open order.

4. Who we share it with

We do not sell or rent your personal data. We share only what is necessary with:

• Payment processor — Razorpay, to process online payments and refunds.
• Shipping partners — Shiprocket and its courier partners, who receive your name, delivery address and phone number to deliver orders and collect exchanges or returns.
• Service providers — our website hosting and email-delivery providers, who process data on our behalf under confidentiality obligations.
• Authorities — government, tax or law-enforcement bodies when required by law, or to protect our rights and prevent fraud.

Some of these providers may store data outside India; where they do, we rely on the safeguards permitted under Indian law.

5. How long we keep it

• Account data is kept while your account is active. If you ask us to delete your account, we will erase it unless we must keep it by law.
• Order and invoice records are kept for as long as tax and accounting laws require (generally up to 8 years).
• Server logs are kept for a limited period for security purposes.
• Newsletter data is kept until you unsubscribe.

6. Cookies and similar technologies

We use a single essential cookie (oyl_session) that keeps you logged in, remembers your cart and protects forms against misuse. It expires when you close your browser. We also save one setting in your browser's local storage to remember if you closed the newsletter pop-up. We currently do not use advertising or third-party analytics cookies; if we introduce them, we will update this policy and ask for your consent where required. Razorpay may set its own cookies on its payment page.

7. How we protect it

We use encrypted connections (HTTPS), store passwords only as one-way hashes, restrict access to personal data to staff who need it, and protect our systems against unauthorised access. No method of transmission or storage is completely secure, but we take reasonable security safeguards as required by law. If a personal data breach occurs, we will notify affected users and the Data Protection Board of India as required.

8. Your rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access a summary of the personal data we hold about you and how it is processed;
• Correct or update inaccurate or incomplete data — you can edit your profile and addresses in My Account at any time;
• Erase your data, subject to legal retention requirements;
• Withdraw consent and unsubscribe from marketing;
• Nominate another person to exercise these rights in the event of your death or incapacity; and
• Grievance redressal — raise a complaint with our Grievance Officer (section 10) and, if unresolved, with the Data Protection Board of India.

To exercise any of these rights, email contact@oroyluna.com from the email address registered with your account. We may need to verify your identity before acting on a request.

9. Children

Our website is intended for people aged 18 and over. If you are under 18, you may use it only with the involvement and verifiable consent of a parent or legal guardian. We do not knowingly process children's data for tracking, behavioural monitoring or targeted advertising.

10. Grievance Officer

In accordance with the Information Technology Act, 2000, the Consumer Protection (E-Commerce) Rules, 2020 and the Digital Personal Data Protection Act, 2023, our Grievance Officer is:

We acknowledge complaints within 48 hours and aim to resolve them within one month of receipt.

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. Significant changes will be highlighted on the website or emailed to registered customers.

12. Contact us

Questions about this policy? Email contact@oroyluna.com or call +91 93172 99544, or use our contact form.